hmm, strange .. i think falko of till should have a look .. i've looked into the ispconfig code, and did found the code where the folders get chown-ed .. and it clearly says "chown vmail ..." .. so i'm out of idea's

Yes, this is very strange. My server was hacked a few days ago and since then i got this problem. I can say that the attacker did a state of the art hack there, he exploited a new phpmyadmin bug thru setup.php (i advice all the users to rename or delete that file) after that he installed a non commercial version of openssh which leaves the root password unchanged and sets up a backup password used for remote root login, unfortunattely for him my sharp eyes noticed that the private key was changed. Well, after that the problems came up... when a create new mailbox its gets owned by root and i get the connection dropped by imap server error when im trying to login via sqmail, and i have to change the mailbox permisions by hand... of course i did a little sh script which does this every 10 mins... but this a temporaru solution...